|Publication number||US8117643 B2|
|Application number||US 12/137,767|
|Publication date||Feb 14, 2012|
|Filing date||Jun 12, 2008|
|Priority date||Jun 12, 2008|
|Also published as||US20090313677|
|Publication number||12137767, 137767, US 8117643 B2, US 8117643B2, US-B2-8117643, US8117643 B2, US8117643B2|
|Inventors||Ranganathan Vidya, Madhusudanan Kandasamy, Ravi A. Shankar|
|Original Assignee||International Business Machines Corporation|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (7), Referenced by (5), Classifications (7), Legal Events (3)|
|External Links: USPTO, USPTO Assignment, Espacenet|
This Invention was made with Government support under PERCS PHASE III, HR001-07-9-002. THE GOVERNMENT HAS CERTAIN RIGHTS IN THIS INVENTION.
The present invention generally relates to a Role Base Access Control (RBAC) system and specifically to defining new roles in the RBAC system.
User's access to resources of a computer system needs to be controlled for security needs of an organization. The control of these accesses is performed by using access rights that define whether and how a user may access the resources. A security system, which is integrated in or added to the operating system of the computer system, performs this access control.
In traditional security systems, a system administrator (hereinafter interchangeably referred to ‘root user’ or ‘super user’) grants or revokes access rights explicitly for individual users or a group of users on respective resources. However, as the number of users increases, and as their access rights are updated from time to time, the access rights in such security systems become increasingly inconvenient to manage. Further, due to the varied and evolving nature of work done by various users on the computer system, it is often difficult to confine ‘super user’ rights to a small restricted set of users. On the other hand, widespread allocation of ‘super user’ rights may compromise the security of the computer system. Additionally, in many organizations, the data stored on the computer system and resources may be confidential and access to such data should desirably be granted on a need only basis. However, system administrators with ‘super user’ rights will have access to such data and resources, irrespective of whether they really need to have this access for their work. This may compromise the confidentiality of the organization's data and resources.
In order to achieve a higher grade of data security and integrity in a computer system, a Role-Based Access Control (RBAC) approach has been developed. The RBAC approach has three main elements: authorizations, roles, and privileges. An authorization is analogous to access rights; it provides a mechanism to grant rights to perform certain actions on the computer system and thereby provides different levels of functionality to different classes of users. A role is a set of management functions unique to a particular class of users of the computer system; multiple authorizations may be assigned to a role in order to allow users under that role to perform the requisite management functions. Privileges are part of the RBAC infrastructure that provides fine granular control of system functions. A user usually acquires privileges based on authorizations granted to their role. In other words, regular users are allowed access to various system functions when they have relevant privileges. Privileges are typically mapped to bit masks and are used in the kernel space to achieve privileged function specific security controls with ease. In practice, a role acts as a definition of a job at the lowest level of granularity used in the enterprise or organization. Roles are similar to the regular user identities except that roles are authorized to perform some privileged tasks. Regular users who are assigned to some roles can perform super user function based on the privileges granted by switching into that role. For example, one role might be to manage file systems, while another role might be to enable creation of user accounts. In the RBAC system, the system administrator only has to grant or revoke authorizations to a role, and group different users of the computer system under each role based on need. The users under a role automatically get the authorizations granted to that role. A super user has more authorizations and privileges than a user. The super user rights are thus divided into granular tasks and assigned to various users based on the authorizations they need for their job or role. For example, a user with the role to manage the file systems will not have authorization for creating the user accounts, and vice-versa, but a super user may have access to both. In this manner, RBAC enables separation of duties among users who have less authorizations and privileges than the traditional super user. The RBAC approach follows the principle of providing “least privilege access” to users, wherein a user has only the least authorizations required to perform his/her role. The RBAC approach has many advantages over traditional security systems such as ease of management, ease of assigning roles to the users (as per their functions in the organization) etc.
However, in many cases there may be situations when a user to whom a role was assigned is not available and that role needs to be assigned to a backup user with some modifications in authorizations of this existing role. The present technique is to create a new role with all required authorizations for the backup user. Management of roles in this manner, particularly for systems that have a large number of users with dynamic role definitions, is a cumbersome process.
In accordance with the foregoing, there is a need in the art of a process, an apparatus, and a program product, for providing improved management of roles in the RBAC system.
A computer implemented process for defining a new role in a Role Based Access Control (RBAC) system is provided. The process includes creating the new role by using mathematical operators with one or more of the following: one or more authorizations and one or more existing roles.
A programmable apparatus for defining a new role in a Role Based Access Control (RBAC) system is provided. The apparatus includes creating the new role by using mathematical operators with one or more of the following: one or more authorizations and one or more existing roles.
A computer program product for causing a computer to define a new role in a Role Based Access Control (RBAC) system is provided. The computer program product includes creating the new role by using mathematical operators with one or more of the following: one or more authorizations and one or more existing roles.
The invention is explained with reference to the accompanying figures. Unless the context clearly requires otherwise, throughout the description and the claims, the words “comprise,” “comprising,” and the like are to be construed in an inclusive sense as opposed to an exclusive or exhaustive sense; that is to say, in a sense of “including, but not limited to.” Words using the singular or plural number also include the plural or singular number respectively. Additionally, the words “herein,” “hereunder,” “above,” “below,” and words of similar import refer to this application as a whole and not to any particular portions of this application. When the word “or” is used in reference to a list of two or more items, that word covers all of the following interpretations of the word: any of the items in the list, all of the items in the list and any combination of the items in the list.
Various embodiments of the present invention disclose a process of creating a new role from some existing roles in a Role Based Access Control (RBAC) system. The new role is created using mathematical operators with the existing roles, or authorizations, or a combination of both the existing roles and the authorizations. Such creation of new roles using existing roles and authorizations facilitates efficient management of roles and authorizations in the RBAC system. For example, when a user to whom an existing role was assigned is unavailable and a backup user needs to be assigned the same role but with some modified authorizations, a new role may be defined for the backup user using a mathematical combination of the unavailable user's role, the backup user's current role, and specific authorizations.
In an embodiment of the present invention, the authorizations are of two types, user-defined authorizations and system-defined authorizations. The user-defined authorizations are customized authorizations that can be defined by a system administrator. On the other hand, the system-defined authorizations are predefined and cannot be modified. The system administrator manages creation and assignment of the roles to users, thus controlling security in the organization. Thus, the system administrator can add, modify or delete the user-defined authorizations.
The authorizations are defined in a hierarchical order separated by a dot operator. In other words, authorization strings can be defined as “ParentAuth.SubParentAuth.SubSubParentAuth” and these strings give a logical representation to an authorization level in the RBAC environment. An exemplary hierarchical representation of a user-defined authorization is “system.filesystem.manage.create”. In the example, when a user's role is given this authorization, the user is able to create files in a file system. Similarly, another exemplary hierarchical representation of a system-defined authorization is “unix.system.boot.info”. In this example, when a user's role is given this authorization, the user is able to display the system's boot information. In an embodiment of the present invention, the hierarchical representation (as in the above exemplary case, dot operator) is operating system specific. Also, the user-defined authorizations and the system-defined authorizations may have different syntaxes from what are shown in the aforementioned examples. Basically, the privileges are assigned to the string based on the level of authorizations. It will be apparent to a person of ordinary skill in the art that the examples shown here are merely for illustrative purposes and do not limit the scope of the present invention. Various embodiments of the present invention may be practiced using other operating systems and their specific nomenclatures for roles and authorizations.
In accordance with various embodiments, the RBAC system includes an authorization database and a role database. The role database stores the existing roles, while the authorization database contains the user-defined authorizations. These databases may be stored in any form in the RBAC system, for example as flat files.
In one embodiment of the present invention, the role database and the authorization database are managed at a local file system of a computer system. In another embodiment of the present invention, the role database and the authorization database are managed remotely through a Lightweight Directory Access Protocol (LDAP). LDAP is a protocol that allows information to be stored centrally in a hierarchical database. The information can be fetched using the LDAP protocol. In an embodiment of the present invention, the authorization definitions will be stored in the authorization database at the user level. The user defined authorizations will be downloaded from user space and it will be kept in kernel tables/attributes. The kernel defined authorizations are pre-defined in the kernel space.
In an embodiment of the present invention, the mathematical operators are, a Not operator (!), a Union operator (∪), an Intersection operator (∩), or a Subtraction operator (−). (An Addition operator (+) may perform a function equivalent to the Union operator (∪).) The Not operator (!) allows negation of the existing roles or the authorizations. The union operator (∪) allows combination of the existing roles and the authorizations. The intersection operator (∩) is used to extract the authorizations or the existing roles which are common in between two existing roles. The subtraction operation (−) is used to remove certain authorizations from the existing roles. It will be apparent to a person of ordinary skill in the art that these one or more mathematical operators are just examples and others mathematical operators can also be used. Basically mathematical operations indicate addition or removal of privileges associated with the authorizations which gets assigned to roles.
In another exemplary embodiment of the present invention,
In another case, a new role R5 is created (not shown in
In another case a new role R6 is created (not shown in
In yet another exemplary embodiment of the present invention, a new role is created using the mathematical operators between certain authorizations and the existing roles. As shown in
In another embodiment of the present invention, a new role is created using the union operator and the subtraction operator between the existing roles and the authorizations.
In an embodiment of the present invention, when a new role is created the authorization database, roles database and other related entities are enabled such that the definition of the new role with mathematical operators is understood by the RBAC system.
In an embodiment of the present invention, main memory 304 stores program instructions that perform one or more process steps as explained in conjunction with the
In an embodiment of the present invention, processor 302 under the control of operating system 316 executes application programs 312. Application programs 312 can be run with program data 314 as input. Application programs 312 can also output their results as program data 314 in main memory 304.
While main memory 304 and DASD 318 are typically separate storage devices, computer system 300 uses well known virtual addressing mechanisms that allow the programs of computer system 300 to run smoothly as if having access to a large, single storage entity, instead of access to multiple, smaller storage entities (e.g., main memory 304 and DASD 318). Therefore, while certain elements are shown to reside in main memory 304, those skilled in the art will recognize that these are not necessarily all completely contained in main memory 304 at the same time. It should be noted that the term “memory” is used herein to generically refer to the entire virtual memory of computer system 300. In addition, an apparatus in accordance with the present invention includes any possible configuration of hardware and software that contains the elements of the invention, whether the apparatus is a single computer system or is comprised of multiple computer systems operating in concert.
In an embodiment of the present invention, the administrator defines new roles using one or more mathematical operators with only authorizations or only existing roles or with a combination thereof. The use of mathematical operators for creating the new roles allows reuse of roles and authorizations from one user to another user. The present invention further allows defining common roles and authorizations between different users. The present invention also allows delegation of roles and authorizations based on definitions using mathematical operators.
The present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment containing both hardware and software elements. In accordance with an embodiment of the present invention, the invention is implemented in software, which includes, but is not limited to firmware, resident software, microcode, etc.
Furthermore, the invention may take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. For the purposes of this description, a computer-usable or computer readable medium may be any apparatus that may contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus or device.
The afore-mentioned medium may be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid-state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk. Current examples of optical disks include compact disk-read only memory (CDROM), compact disk-read/write (CD-R/W), DVD and blu-ray disk.
In the aforesaid description, specific embodiments of the present invention have been described by way of examples with reference to the accompanying figures and drawings. One of ordinary skill in the art will appreciate that various modifications and changes can be made to the embodiments without departing from the scope of the present invention as set forth in the claims below. Accordingly, the specification and figures are to be regarded in an illustrative rather than a restrictive sense, and all such modifications are intended to be included within the scope of present invention.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US6859810||May 17, 2002||Feb 22, 2005||Bea Systems, Inc.||Declarative specification and engine for non-isomorphic data mapping|
|US7203697||Dec 10, 2003||Apr 10, 2007||International Business Machines Corporation||Fine-grained authorization using mbeans|
|US7284271||Oct 22, 2001||Oct 16, 2007||Microsoft Corporation||Authorizing a requesting entity to operate upon data structures|
|US7451477 *||Oct 24, 2002||Nov 11, 2008||Bea Systems, Inc.||System and method for rule-based entitlements|
|US7774601 *||Apr 6, 2004||Aug 10, 2010||Bea Systems, Inc.||Method for delegated administration|
|US20060218394 *||Mar 28, 2005||Sep 28, 2006||Yang Dung C||Organizational role-based controlled access management system|
|US20070240231 *||Mar 29, 2006||Oct 11, 2007||Haswarey Bashir A||Managing objects in a role based access control system|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US8955057||Oct 17, 2012||Feb 10, 2015||International Business Machines Corporation||Managing access to class objects in a system utilizing a role-based access control framework|
|US9122889||Nov 12, 2013||Sep 1, 2015||International Business Machines Corporation||Managing access to class objects in a system utilizing a role-based access control framework|
|US9298933||Jul 18, 2013||Mar 29, 2016||Sybase, Inc.||Autonomous role-based security for database management systems|
|US9679264||Nov 6, 2012||Jun 13, 2017||Oracle International Corporation||Role discovery using privilege cluster analysis|
|US20160379001 *||Jun 26, 2015||Dec 29, 2016||Sap Se||Role Analyzer and Optimizer in Database Systems|
|U.S. Classification||726/2, 726/4|
|Cooperative Classification||G06F21/6218, G06F21/604|
|European Classification||G06F21/62B, G06F21/60B|
|Jun 12, 2008||AS||Assignment|
Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:VIDYA, RANGANATHAN;KANDASAMY, MADHUSUDANAN;SHANKAR, RAVIA.;REEL/FRAME:021087/0024
Effective date: 20080603
|Oct 7, 2009||AS||Assignment|
Owner name: DARPA, VIRGINIA
Free format text: CONFIRMATORY LICENSE;ASSIGNOR:INTERNATIONAL BUSINESS MACHINES INC.;REEL/FRAME:023338/0266
Effective date: 20091006
|Aug 3, 2015||FPAY||Fee payment|
Year of fee payment: 4